3. Preservation - Before starting the investigation of the acquired data, we create a second forensic image that is identical to the first image and the original drive. This duplicate is called the "working copy" and it also needs to be hashed and verified. After creating the working copy, the first image is stored in a fireproof evidence safe at our secured facility. The first image will only be removed from the safe under two conditions: 1) if the working copy becomes damaged or corrupted during analysis, in which case we will create a new working copy following the same procedure as before, or 2) if the case is resolved, we can either return the evidence back to the client or securely destroy all evidence images and working copies that we posses.